A class action lawsuit has been filed against big-three consumer credit bureau Experian over reports that the company did little to prevent identity thieves from hijacking consumer accounts. The legal filing cites liberally from an investigation KrebsOnSecurity published in July, which found that identity thieves were…
Motivation The Right Reasons Tech Stack Implementation Mail rate and Spaminess Ongoing Maintenance Alternatives Conclusion
“ Secure Element ” (SE) chips have traditionally taken a very closed-source, NDA-heavy approach. Thus, it piqued my interest when an early-stage SE chip startup, Cramium (still in stealth mode), approached me to advise on open source strategy. This blog post explains my reasoning for agreeing to advise Cramium, and…
My plans for Go 1.20 include landing the crypto/ecdh package, making progress on moving math/big out of the security perimeter, and a batch of crypto/tls work.
One of the unexpected 1 outcomes of the Russian invasion in Ukraine is a large increase in nefarious access attempts to servers under my control, not necessarily appearing to arise from Russian IP addresses. There are the usual attempts at brute-forcing SSH access, for instance, but also a flurry of malevolent HTTP(S)…
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
Thanks to @yarbabin for the logo Electronic payment systems have existed on the Internet for a long time, and some bugs in them are twenty years old. We’ve found critical vulnerabilities allowing us…
In this article I will discuss how I successfully escaped the PS2 emulator developed for the PlayStation 4. See also Part 2 , covering the next part of the exploit chain, and PlayStation's response to the research.
Group for Apps and Services on Exascale Research Infrastructure is a research, development, and teaching unit at FIDIT + MedRi.
Riley Goodside, yesterday: Exploiting GPT-3 prompts with malicious inputs that order the model to ignore its previous directions. pic.twitter.com/I0NVr9LOJq- Riley Goodside (@goodside) September 12, 2022 Riley provided several examples. Here’s …
On Tuesday, KrebsOnSecurity warned that hackers increasingly are using compromised government and police department email accounts to obtain sensitive customer data from mobile providers, ISPs and social media companies. Today, one of the U.S. Senate’s most tech-savvy lawmakers said he was troubled by the report and…
Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. He’d been on the job less than six months, and because of the way his predecessor architected things, the company’s data backups also were encrypted by Zeppelin. After two weeks of…
Interesting telephone equipment in the offices of Ukrainian president Zelensky
You could always sign Git commits with a GPG key, but now your SSH key is just as powerful!
There are a lot of scams out there, but one that's been plaguing bloggers like me lately is a novel twist: A fake DMCA takedown notice that's actually a link insertion scam! Beware: The notices I'm getting are very convincing-looking, complete with a fake law firm website!
We look at how fuzzing should have caught the OpenSSL Punycode vulnerability, and why that code was even necessary in the first place.
Hey hey! Welcome to my little corner of the internet. I am also known as 'Diz'! I made this site to document my research and contributions throughout the years, and other fun stuff I could come up with. Hope you're having a good day/afternoon/night wherever you are!
Update 6/28/22: a reader reached out to me and let me know that Malwarebytes now detects and removes this malware as Adware.Choprex and OSX.Generic.Suspicious - so if you're reading this because you are affected, go download Malwarebytes and run a full scan. Thanks Yegor!
This post describes the implementation and use of pledge() and unveil() in SerenityOS.
VS Code collects telemetry data to help understand Microsoft how to improve the product. Is it above board? Can I turn it off completely?
A Hacker's Blog of Unintended Use and Insomnia.
This post ended up being incredibly long comprehensive. I’m afraid that many people won’t read enough to get everything that’s important, so here are the key points:
I’m continuing my coverage of dangerous Internet bills in the California legislature. This job is especially challenging during an election year, when legislators rally behind the “protect the kids” mantra to pursue bills that are likely to hurt, or at...
I have a vehement dislike for misleading advertising. We see it every day; weight loss pills, make money fast schemes and if you travel in the same circles I do, claims that extended validation (EV) certificates actually do something useful: > Why are you still claiming this @digicert [https://twitter.com/
